# HG changeset patch
# User Magnus Henoch <mange@freemail.hu>
# Date 1163018076 0
# Node ID 8368b321b13d5ce9502e26a2f97876b06ef20e28
# Parent  caf324c6806fb533d7b0d230bff6c4798c62c503
(url-http-handle-authentication): If there are several authentication
headers, use the strongest available method.

diff -r caf324c6806f -r 8368b321b13d lisp/url/url-http.el
--- a/lisp/url/url-http.el	Wed Nov 08 19:38:38 2006 +0000
+++ b/lisp/url/url-http.el	Wed Nov 08 20:34:36 2006 +0000
@@ -313,21 +313,27 @@
 	(type nil)
 	(url (url-recreate-url url-current-object))
 	(url-basic-auth-storage 'url-http-real-basic-auth-storage)
-	auth)
+	auth
+	(strength 0))
     ;; Cheating, but who cares? :)
     (if proxy
 	(setq url-basic-auth-storage 'url-http-proxy-basic-auth-storage))
 
-    ;; find first supported auth
-    (while auths
-      (setq auth (url-eat-trailing-space (url-strip-leading-spaces (car auths))))
-      (if (string-match "[ \t]" auth)
-	  (setq type (downcase (substring auth 0 (match-beginning 0))))
-	(setq type (downcase auth)))
-      (if (url-auth-registered type)
-	  (setq auths nil)		; no more check
-	(setq auth nil
-	      auths (cdr auths))))
+    ;; find strongest supported auth
+    (dolist (this-auth auths)
+      (setq this-auth (url-eat-trailing-space 
+		       (url-strip-leading-spaces 
+			this-auth)))
+      (let* ((this-type 
+	      (if (string-match "[ \t]" this-auth)
+		  (downcase (substring this-auth 0 (match-beginning 0)))
+		(downcase this-auth)))
+	     (registered (url-auth-registered this-type))
+	     (this-strength (cddr registered)))
+	(when (and registered (> this-strength strength))
+	  (setq auth this-auth
+		type this-type
+		strength this-strength))))
 
     (if (not (url-auth-registered type))
 	(progn